Set your exchange in password or biometric before withdraw.

[tbct_mt2]

I am sorry to heard your fund loss at Binance exchange, I think very important how to secure our exchange account and nowadays Binance as my experienced exchange just taking 2FA code only for withdrawing fund.

The fund is not lost yet, just not accessible at the moment. The person can recover his account by going to account recover process requested by Binance with surely many verification requirements. I believe that it is possible to pass those verification step if the person is the original owner of that account, and it is only impossible with a hacker.

Even it is possible to recover the account, it is still a very big lesson for the person and he must change his practice, make email, Binance account, 2FA backups for self recoveries more easily and almost immediately by himself.

Don't have backup and have to rely on exchange support for account recovery will need time, and with risk of recovery failure, then fund loss.

[Joy- maker]

Op when I first came across your thread this was the exact question that came into my mind which I will like to ask you, because if actually your story is true and your friend phone was stolen how did the thief bypass the password of your friend phone and then enter his or her  both trading exchanges and stole your friend's fund? but wether your story is true of not your advice is valid let's not only leave our exchange withdrawal only on authentication code let's add more security by including password or biometric before withdraw just in case someone successfully have access to our mobile phone or PC, so that it will be very difficult for the person to successfully make a withdrawal from our trading exchange.

[X-ray]

There's something that happened yesterday which is making me to create this thread a friend of mine who is a crypto trader, he usually use binance and kucoin for his trading and we all know when it comes to withdrawing your funds in this exchanges you can set it using authentication code, email, password or biometric but you can still set it in a way you can use only the authentication code to withdraw and the authentication app is usually on the phone or system.
Yesterday someone store my friends phone entered his binance and kucoin Because it was already logged in and withdraw his crypto coins, and this was possible because he used only authentication code for withdraw and since the authentication app was on his phone it was easy for the person to withdraw, so please Set your exchange in password or biometric before withdraw because if it was set like that the person wouldn't have been able to withdraw his crypto coins.

How is that possible? did your friend deliberately give password to the thief? because I don't think biometric is enough to prevent this. If somebody got access to your 2fa and password they can disable your biometric easily.

That's just how it is. I think there's bigger security hole that you should be concerned here.

[Leahized]

Set your exchange in password or biometric before withdraw because if it was set like that the person wouldn't have been able to withdraw his crypto coins.

Currently I am only using binance exchanger. However, from 2022 to 2023, I used kucoin for one year. But there had to set up password to trade and same for withdrawal. I do not know what weakness it is in your friend's case for such a situation. Although every exchanger now requires a 2FA request. And while using kucoin I was setting up passwords. As per my knowledge it is mandatory to setup kucoin user password. Anyway, thank you so much for sharing such information. But we should always be careful about this. Because if there is any kind of security bug, I can lose everything. Also I always use authenticator code.

[Findingnemo]

Keep your smartphone away from anyone else, it's not because it is filled with authentic apps or exchange accounts logged into, it also might have your spicy private pictures.

I wonder what your friend was doing when the person stole from his exchange account using the codes he received on the same device.

[Potato Chips]

Goddamn that's rough.

Honestly, this is one of the reasons why it's best to also keep your authenticator app on a separate device. In addition to theft risk, in case your phone got a malware, you can be sure your OTPs are not affected because it would be on a separate device. Lot's of good cheap entry level smartphone are available right now even from known brands like samsung. I think it's worth the investment.

or you could buy a hardware authentication device like yubikey which is actually something I'm looking into right now with the black Friday sale incoming.

[Finebone]

How did the person that stole his phone know his phone password or able to bypass the face unlock or fingerprint? I know this is not a question that you can answer but I think without a threat like a wrench attack, the bad actors should not be able to have access to his phone, not to talk of having access to his exchange account.

My sentiment exactly, when I saw the op post, the first thing that comes to my mind is how did the criminals bypass his password before having access to his phone?
Because if he flashes the phone, everything including his binance  app will be deleted, so this is a very valid question.

The best way I ensure top security on my devices is by putting double layer of password on my devices by downloading app locks, that way, if you can access the device, you will need another type of password to access some certain important apps I specifically lock myself, even the Google authenticator will be locked, so with that, I believe that my security is a bit secured, added with the fact that I have locked my sim card for the past 10 years now, anything that makes my device to go off, before network will get back into that sim card, they will ask for a personal unblocking key code, so this is how i have secured my device successfully in the past few years.

[JeffBrad12]

Accessing other people's phone is considered a crime in many countries. If you're so sure that your money got stolen by that rando you can sue them. If it's good chunk of money being stolen maybe it's worth a try.
Never ever gave away your phone to random stranger ever. it's piece of your privacy and contains all your credentials to banking system and any financial apps.

[Ever-young]

Accessing other people's phone is considered a crime in many countries. If you're so sure that your money got stolen by that rando you can sue them. If it's good chunk of money being stolen maybe it's worth a try.
Never ever gave away your phone to random stranger ever. it's piece of your privacy and contains all your credentials to banking system and any financial apps.

Some of the times, those who end up swindling us ain’t people who are strangers to us but those who very close to us, because I don’t think anyone will be able to leave their phone with a total stranger, before leaving our phones with someone, except the person is our spouse , we should thing it twice and even when we do, we need to make sure we keep them on close supervision and such, also increase our security measures.

[adultcrypto]

I do not like passkey
It is better to have authenticor app on another device. Avoid passkey also for higher security.

Most people use passkeys and exchanges do suggest them it work with the fingerprint that requires that only the owner of the account can access it. If you have anything against passkey, kindly bring it forward so that others will learn. I use passkey in my exchange account but that is only when I want to buy or sell, I make the deposit and withdraw to my wallet. I don't save my money on exchanges, that way I don't know of any big risk involved in using passkey.

[michellee]

Hey, I got the same experience but I followed the instructions and didn't take too long, I can withdraw the money. I don't know if that case occurs because I don't often withdraw my money from Binance or not.

My phone is always with me. Only I have access to my phone. I will not allow other people except my family to access my phone.

But I hope that is a temporary case and will not happen in the future.

Don't forget to set your password, biometric, or other security measures to secure your exchange account.

[justdimin]

Hey, I got the same experience but I followed the instructions and didn't take too long, I can withdraw the money. I don't know if that case occurs because I don't often withdraw my money from Binance or not.

My phone is always with me. Only I have access to my phone. I will not allow other people except my family to access my phone.

But I hope that is a temporary case and will not happen in the future.

Don't forget to set your password, biometric, or other security measures to secure your exchange account.

In case of a hack, these methods will prove to be useful but what if our complete phone is stolen just as OP explained. We have a lot of credential data in our phone including our SIM for verification, our emails, our saved passwords and way lot. Everything will be compromised and the person who stole the phone might be able to get into everything which can be our banking accounts or crypto exchanges.

Modern smartphones have a "find-my-phone" feature though which can make it easier for us to find the phone. Because to access anything on our phone, the thief will need to access mobile data which will reveal his/her location. Also we can easily lock or even wipe our phone remotely if we have that feature enabled. So along with setting biometric or password to our trading account, we should also think of a way to secure our phone in case of theft.

[Emitdama]

There's something that happened yesterday which is making me to create this thread a friend of mine who is a crypto trader, he usually use binance and kucoin for his trading and we all know when it comes to withdrawing your funds in this exchanges you can set it using authentication code, email, password or biometric but you can still set it in a way you can use only the authentication code to withdraw and the authentication app is usually on the phone or system.

If the phone was stolen than there is nothing much that can be done. Because even the bio-metric of password can be reset using phone, email or authenticator verification. The thief will already have access to all these if he stole the phone. I still wonder, we all have passwords for our phone right. So even if the thief was able to steal the phone, how was he able to crack the password without actually resetting the phone? It seems a bit difficult for me to digest that they bypassed the phone security code and got into the trading account and were able to withdraw the funds.

Was the phone lost or stolen? If it was stolen than maybe your friend was targeted and someone knew what exactly needs to be done before they stole the phone. Your friends should file a FIR immediately and should also inform the exchanges about the theft.

[Bobrox]

In case of a hack, these methods will prove to be useful but what if our complete phone is stolen just as OP explained. We have a lot of credential data in our phone including our SIM for verification, our emails, our saved passwords and way lot. Everything will be compromised and the person who stole the phone might be able to get into everything which can be our banking accounts or crypto exchanges.

Modern smartphones have a "find-my-phone" feature though which can make it easier for us to find the phone. Because to access anything on our phone, the thief will need to access mobile data which will reveal his/her location. Also we can easily lock or even wipe our phone remotely if we have that feature enabled. So along with setting biometric or password to our trading account, we should also think of a way to secure our phone in case of theft.

Set up biometric or password trading account is important way if some time mobile phones is stolen and we have enough time for recovering or change all data about exchange account. Nowadays all exchange account have regulation after change password or set up new trading password account will hold until one day to three days later and its enough for us to secure all our exchange account data.

Usually in one mobile phone including all data for exchange market account from email use registering at exchange market, 2FA APPS and the account existing already login in that mobile phone exactly using exchange app make us get longer time without re login any more difference when access exchange market trough website.

[knowngunman]

How did the person that stole his phone know his phone password or able to bypass the face unlock or fingerprint? I know this is not a question that you can answer but I think without a threat like a wrench attack, the bad actors should not be able to have access to his phone, not to talk of having access to his exchange account.
(...)

Maybe the phone got stolen while the phone was unlocked  ?
But it's still fishy because even if it's unlocked and some phones and exchanges will ask verification again, like biometrics, even if the phone is unlocked already.

Yeah, Biometric still important because most of exchange now only have 2FA and email verification to login or withdraw, so if phone is stolen and unlocked, they can easily open your 2FA app in your phone and the email app you are using.

Wait... Aren't you aware phone can be used without password? 

Setting Password, facial verification or biometric on your device is optional and not compulsory before you can make use of the phone. Some people prefer to use their phone with just a slide to unlock the screen. In this case, the thief doesn't have anything to worry about with unlocking the phone.

What is confusing here is how the exchange allows a withdrawal with 2FA which is a secondary security feature on exchanges. Password is the primary security for log in and approve transactions while email and SMS verification are alternatives primary security. While some exchanges made it mandatory to set 2FA, others made it optional. I see it as a flaw for exchange to rely on 2FA alone.

[Charles-Tim]

Wait... Aren't you aware phone can be used without password? 

Setting Password, facial verification or biometric on your device is optional and not compulsory before you can make use of the phone. Some people prefer to use their phone with just a slide to unlock the screen. In this case, the thief doesn't have anything to worry about with unlocking the phone.

What is confusing here is how the exchange allows a withdrawal with 2FA which is a secondary security feature on exchanges. Password is the primary security for log in and approve transactions while email and SMS verification are alternatives primary security. While some exchanges made it mandatory to set 2FA, others made it optional. I see it as a flaw for exchange to rely on 2FA alone.

In this regard, I will not blame the exchange but blame the user. Even on a phone that is not having sensitive apps like banks, wallet and exchange apps, I will still prefer to use password, not to talk of phones that my exchange accounts are. No exchange that will allow only 2FA, the person will still need to login with other information.

[gunhell16]

I’ve been using several exchanges with 2FA for years now, and in all that time, I’ve never had a problem like that. The real question here is, how did your friend's phone end up in someone
else's hands? Was it stolen, or did they just misplace it?

Also, it’s quite impressive that the person who got it knew about cryptocurrency transactions. Where did the phone go missing? At their job? At their house? Or what?
There’s just no clear reason as to how your friend's phone was lost.

[DPHOR]

I think before this stories can be well understand is that; your friend's phone was stolen by someone else and he didn't know who stole the phone then he Binance account was already logged on the app without him signing out right? Okay, when the person stole the phone and his Binance and Kucoin is inside same phone and when stole the phone that person easily open the phone and began to withdraw his money since same phone was were his 2fa app is it was that easier for them to withdraw and input code when they asked about it right?

To know it more better is to tell people that they should use same phone they have their 2fa stored, instead they should have separate phone they don't usually use at all time and keep that at home so that even though the phone got stolen they wouldn't have access to his funds because most exchange before you withdrawal they usually asked for 2fa code, mail code before they can be able to withdraw but this your friend has all this logged on phone that was why it was very easier for them to withdraw his phone.

[taufik123]

-snip-
Also, it’s quite impressive that the person who got it knew about cryptocurrency transactions. Where did the phone go missing? At their job? At their house? Or what?
There’s just no clear reason as to how your friend's phone was lost.

Maybe they have been targeted for flexing or something like that, because many flexing cases end up being the target of robbery.

But smartphones now have high security and are not even easy to break into, to bypass the PIN code alone is not as easy as it used to be.
Even though it can be opened, the data and applications will be deleted and will not be able to be recovered again.

It's just smartphone security that is the first layer of security, then Exchange security with 2FA and Biometric passkey, it's more difficult.

[SquirrelJulietGarden]

Maybe they have been targeted for flexing or something like that, because many flexing cases end up being the target of robbery.

But smartphones now have high security and are not even easy to break into, to bypass the PIN code alone is not as easy as it used to be.
Even though it can be opened, the data and applications will be deleted and will not be able to be recovered again.

It's just smartphone security that is the first layer of security, then Exchange security with 2FA and Biometric passkey, it's more difficult.

Good or bad security, it does not depend on your smart phone but mainly depends on your practice on that phone. If you have very bad habit on your phone, on the Internet, your phone can be infected with malicious dangerous things, and if your phone does not have any Internet security/ antivirus software, the infection is like unavoidable, only matter of time.

If you use your phone to store bitcoin and cryptocurrency, your email, your exchange accounts, I believe that you will lose your accounts and money in future.

In addition, smart phone can be lost or broken physically and it's not recommended to store all or most of your money in your smart phone. Always use your smart phone as a hot wallet with small fund, and never forget to back up your wallets.